Practice Safeguards

Ready before the 2027 filing season

Your firm needs a written security plan. Get one in place before filing season.

A complete, fill-in-the-blanks WISP template for tax preparers, enrolled agents, CPAs and bookkeeping practices, written by a CISM-certified security manager and mapped line by line to the FTC Safeguards Rule and IRS Publication 5708 (Rev. 8-2024).

Get the WISP Kit $79 Check your firm in 60 seconds
Written Information Security Plan Editable .docx

Ridgeway Tax & Bookkeeping

Qualified Individual
Dana Ruiz, EA
Effective date
January 4, 2027
Next review
Every 12 months, before PTIN renewal

6.2 Multi-factor authentication

§ 314.4(c)(5)

MFA is required for any individual accessing any information system, including tax software, email and the client portal.

6.9 Data retention and disposal

§ 314.4(c)(6)

Customer information is disposed of no later than two years after last use.

Mapped to 16 CFR Part 314Every Safeguards Rule requirement
Built on IRS Pub 5708Its structure, with the gaps closed
Written by a CISM15+ years in security
Editable Word filesInstant download

If you prepare tax returns, federal law treats you as a financial institution.

Under the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule, tax preparers, enrolled agents, CPAs and other tax and accounting professionals are financial institutions regardless of size, and must keep a written information security plan. The IRS also calls it a data security plan.

Most small offices know they need one. The hard part is finding a weekend to write it, and knowing whether what you wrote actually covers the rule. Read our guide to WISP requirements for tax preparers.

  • A named person in charge of security314.4(a)
  • Multi-factor login314.4(c)(5)
  • Encryption of client data314.4(c)(3)
  • Staff security training314.4(e)
  • Vendor oversight314.4(f)
  • A plan for what to do after a breach314.4(h)

Five mistakes that leave a tax office exposed.

Each one maps to a requirement in the FTC Safeguards Rule, and each is covered in the kit.

  1. Ignoring physical security

    Client folders on an open desk or an unlocked back room undo the best encryption. The rule expects access controls that include physical ones, as appropriate.

    314.4(c)(1) · Plan section 6.10

  2. Skipping vendor oversight

    Your IT provider, cloud host and shredding service all touch client data. The rule requires you to choose capable providers and require them, by contract, to protect it.

    314.4(f) · Plan section 10, Appendix F

  3. No written incident response plan

    A breach during filing season is the wrong time to decide who to call. Write down who to notify, including the IRS Stakeholder Liaison and, in some cases, the FTC.

    314.4(h), (j) · Plan section 11

  4. Treating the WISP as a one-time project

    New software, new staff and new vendors all change your risk. The plan has to be reviewed and adjusted, not filed and forgotten.

    314.4(g) · Plan section 9, Appendix H

  5. Assuming a small office is exempt

    The rule applies regardless of size. Firms with information on fewer than 5,000 consumers are excused from only a few written requirements, not from the duty to protect client data.

    314.6 · Marked in the kit
$20.9 billionin cybercrime losses reported to the FBI in 2025, from 1,008,597 complaints.Source: FBI IC3 2025 report
Line 11of IRS Form W-12 asks every PTIN renewer to acknowledge that paid preparers are required by law to keep a written information security plan.Source: IRS Form W-12
Any sizeTax and accounting professionals are treated as financial institutions under GLBA, regardless of firm size.Source: 16 CFR Part 314

Check your firm in 60 seconds.

Three questions from the rule. Answer for your firm today, not what's planned.

Your answers stay in your browser.

Your firm has a written security plan, reviewed in the last 12 months.314.3; 314.4(g)
Multi-factor authentication is on for email, your client portal and cloud storage, not just tax software.314.4(c)(5)
Laptops and office computers use full-disk encryption, such as BitLocker or FileVault.314.4(c)(3)

Answer all three to see your result.

The free IRS WISP template is a good start. It says so itself.

IRS Publication 5708 describes its sample as a starting point, not a final plan, and encourages tax pros to consult technical experts. When we mapped it against the FTC Safeguards Rule, we found five places where the sample stops short.

Area IRS sample plan What the rule requires In the WISP Kit
Multi-factor authentication314.4(c)(5) Partial
Covers remote login.		 MFA for anyone accessing any information system. Section 6.2
MFA for tax software, email, the portal, cloud storage, remote access and admin accounts.
Encryption314.4(c)(3) Partial
No firm-wide at-rest standard.		 Encryption of customer information in transit and at rest. Section 6.3
An encryption standard for both, plus an exception register.
Data disposal314.4(c)(6) Blank
Leaves the retention period empty.		 Disposal no more than two years after last use, by default. Section 6.9
A disposal policy and a ready retention schedule (Appendix C).
Outsourced security314.4(a) Missing
No wording for offices that rely on an IT provider.		 Addresses that arrangement directly. Sections 3 and 10
Ready wording for firms that outsource IT, plus a provider register.
Incident response314.4(h) Partial
Lists who to notify, not structured to the rule.		 A response plan covering seven named areas. Section 11
A step-by-step breach response with IRS and FTC notification guidance.

Our kit starts from the IRS sample's structure and fills those gaps, so your plan reflects both.

Look inside the WISP template kit.

Three Word files. Everything you need to write, adopt and maintain your written information security plan. These are the real contents.

Contents

  1. Purpose, objectives and scope
  2. Firm profile and applicability
  3. Roles and responsibilities
  4. Information and asset inventory
  5. Risk assessment
  6. Safeguards: access, MFA, encryption, network, remote access, change management, monitoring, disposal, physical security
  7. Personnel and training
  8. Testing and monitoring of safeguards
  9. Program evaluation and annual review
  10. Service provider oversight
  11. Incident response and notification
  12. Reporting
  13. Implementation

Forms (appendices)

  • Authorized users
  • Asset and data inventory
  • Retention and disposal schedule
  • Acknowledgment of understanding
  • MFA and encryption exception register
  • Service provider register
  • Incident contact sheet
  • Review and change log
  • Compliance map

Written Information Security Plan

6.2 Multi-factor authentication (MFA)

Requirement: 16 CFR 314.4(c)(5)

MFA is required for any individual accessing any information system that holds or connects to customer information, not only remote access. This includes tax software, email, the client portal, cloud storage, remote access tools, the password manager and administrative accounts.

Any exception requires the QI's written approval of a reasonably equivalent or more secure control, recorded in Appendix E.

What's different here: The IRS sample plan covers MFA for remote login only. The Safeguards Rule covers any information system, so this section is intentionally broader.

Drafting notes like this appear in the kit and are removed when you finalize your plan.

Everything included

15 policies, plans and forms a tax office needs, and where each one lives in the kit.

  • Written information security plan (WISP)Your Security Plan
  • Risk assessment worksheetRisk Assessment Worksheet
  • Data breach response planPlan, section 11
  • Incident contact sheetAppendix G
  • Password and MFA policySections 6.1 and 6.2
  • Encryption policySection 6.3
  • MFA and encryption exception registerAppendix E
  • Vendor management checklistSection 10 and Appendix F
  • Data retention and disposal scheduleSection 6.9 and Appendix C
  • Asset and data inventoryAppendix B
  • Authorized user listAppendix A
  • Employee acknowledgment formAppendix D
  • Security awareness training and quizStaff Security Training
  • Training attendance recordStaff Security Training
  • Annual review and change logSection 9 and Appendix H

Three ways to get a plan written.

Write it from the free IRS sample

Free, plus your weekends

A solid outline, but you'll need to find and close the gaps against the rule yourself.

Hire a custom consultant

Often $600 to $1,000 or more

Tailored to you, at a price built for larger firms than a one-to-ten-person office.

Practice Safeguards WISP Kit

$79, or $449 with our help

The IRS structure with the gaps already closed, mapped to every requirement, ready to fill in this week.

Written by a security professional, not a marketing team.

Every document in the kit is written by a Certified Information Security Manager (CISM) with 15+ years in network engineering, managed security services and technical program management, including work with large telecom and managed security providers.

The kit applies the same controls used in enterprise security programs, scaled for a one-to-ten-person tax office.

CISM
Certified Information Security Manager
15+ yrs
Network engineering, managed security services and technical program management
PMP
Project Management Professional
PCNSP
Palo Alto Networks certified

One price. No subscription required.

Buy the kit and write the plan yourself, or let us draft it from your answers and review it with you.

WISP Kit

For offices ready to fill it in themselves.

$79one-time

  • Your Security Plan with all 8 forms
  • Risk Assessment Worksheet
  • Staff Security Training
  • Draft plan tailored to your office
  • Review call
Get the WISP Kit

Instant download

We draft it with you

Done-With-You

For offices that want it done right, fast.

$449one-time

  • Everything in the WISP Kit
  • Questionnaire turned into a draft plan tailored to your office
  • 30-minute review call with a CISM-certified security professional
  • Updated templates when IRS or FTC guidance changes, 1 year included
  • Annual review reminder before PTIN renewal
Start Done-With-You

We'll send the questionnaire right after purchase

Microsoft Word, fully editable Secure checkout Damaged or incomplete files fixed or refunded

Questions tax pros ask.

Something not covered here? Email support@wisptemplate.com. We reply within 1 business day.

Does this make my firm compliant?
The kit gives you a complete, rule-mapped plan. Compliance depends on actually doing what the plan says (turning on MFA, training staff and so on), which only your firm can do. The kit tells you exactly what that is.
I'm a sole practitioner. Is this overkill?
No. The rule applies regardless of size, but firms holding information on fewer than 5,000 consumers are excused from a few written requirements. The kit marks those sections as optional so you can skip them.
What format are the files?
Microsoft Word, so you can edit everything. Delivered as an instant download after purchase.
How long does it take to complete?
It depends on your office. The Risk Assessment Worksheet takes about 60 to 90 minutes for a small office, and most of the plan is filling in highlighted fields with details you already know, such as your software, devices and vendors.
What if a breach happens?
The incident response plan covers what to do and who to notify, including the IRS Stakeholder Liaison and, if 500 or more consumers are affected, the FTC within 30 days of discovery.
Is this legal advice?
No. The kit is a professional template and guidance. For legal questions about your obligations, consult an attorney.
What's your refund policy?
Because the kit is delivered instantly as editable files, all sales are final. If a file is damaged, won't open, or is missing something this page describes, email us within 14 days of purchase and we'll fix it, replace it or refund you. Read the full refund policy.

Stop putting off the plan you're required to have.

Pick the path that fits your office. Either way, you'll have a written plan mapped to the rule before filing season.

WISP Kit $79 Fill it in yourself. Instant download. Get the kit Done-With-You $449 We draft it from your answers and review it with you. Start Done-With-You
  • Secure checkout
  • Editable Word files
  • Replies within 1 business day